github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

✨ Feature Request: onRateLimitHit callback or hooks for custom handling behavior #2458

New Issue
Closed
opened 2026-03-13 09:56:04 -05:00 by GiteaMirror · 3 comments
GiteaMirror commented 2026-03-13 09:56:04 -05:00
Owner
Copy Link

Originally created by @mok419 on GitHub (Dec 4, 2025).

Is this suited for github?

  • Yes, this is suited for github

Is your feature request related to a problem? Please describe.

Summary
Currently, Better Auth’s rate-limiting returns a hard-coded 429 response with no extensibility point.
Developers cannot intercept rate-limit events or provide alternative user paths.

Example use-cases this prevents:

On /sign-in, if the user hits rate limit I want to show a Magic Link fallback instead of a 429 error.

Trigger a side-effect when a suspicious IP exceeds limits (logging, drawing attention, abuse detection).

Dynamically block or captcha-gate specific IPs via custom logic.

Throttle login attempts differently per context: if a user already verified their email → let them trigger a magic link even if hitting brute-force login limits.

Right now, all these cases are impossible without fully disabling Better Auth’s limiter and implementing a separate one externally.

Describe the solution you'd like

Rate-limit enforcement is hard-coded here:

if (shouldRateLimit(max, window, data)) {
const retryAfter = getRetryAfter(data.lastRequest, window);
return rateLimitResponse(retryAfter);
}

There’s no hook or ability for plugins to override that behavior.

Plugins can define rule settings (window, max) but not behavior. I'd like to be able to define custom functions for if a route specific window rate limit is hit or if the global limit is hit!

Describe alternatives you've considered

Currently considering disabling rate limiting and writing my own custom rate limiter!

I've also considered writing a plugin, but there is no entrypoint for me to add a function into the current rate limiter and I don't want to fork out of the main branch as it will stop me from making future updates!

Additional context

There was two goals I was trying to achieve:

  1. If the login rate limit is hit, I want to force the user to request a magic link instead, they have no more password attempts.
  2. I would like to block IPs at firewall level if they are consistently abusing endpoints
Originally created by @mok419 on GitHub (Dec 4, 2025). ### Is this suited for github? - [x] Yes, this is suited for github ### Is your feature request related to a problem? Please describe. Summary Currently, Better Auth’s rate-limiting returns a hard-coded 429 response with no extensibility point. Developers cannot intercept rate-limit events or provide alternative user paths. Example use-cases this prevents: On /sign-in, if the user hits rate limit I want to show a Magic Link fallback instead of a 429 error. Trigger a side-effect when a suspicious IP exceeds limits (logging, drawing attention, abuse detection). Dynamically block or captcha-gate specific IPs via custom logic. Throttle login attempts differently per context: if a user already verified their email → let them trigger a magic link even if hitting brute-force login limits. Right now, all these cases are impossible without fully disabling Better Auth’s limiter and implementing a separate one externally. ### Describe the solution you'd like Rate-limit enforcement is hard-coded here: if (shouldRateLimit(max, window, data)) { const retryAfter = getRetryAfter(data.lastRequest, window); return rateLimitResponse(retryAfter); } There’s no hook or ability for plugins to override that behavior. Plugins can define rule settings (window, max) but not behavior. I'd like to be able to define custom functions for if a route specific window rate limit is hit or if the global limit is hit! ### Describe alternatives you've considered Currently considering disabling rate limiting and writing my own custom rate limiter! I've also considered writing a plugin, but there is no entrypoint for me to add a function into the current rate limiter and I don't want to fork out of the main branch as it will stop me from making future updates! ### Additional context There was two goals I was trying to achieve: 1. If the login rate limit is hit, I want to force the user to request a magic link instead, they have no more password attempts. 2. I would like to block IPs at firewall level if they are consistently abusing endpoints
GiteaMirror added the enhancement label 2026-03-13 09:56:04 -05:00
GiteaMirror commented 2026-03-13 09:56:06 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Dec 4, 2025):

(tag @better-auth-agent if you would like an answer from the Agent)

If you need more help, tag @better-auth-agent in a comment so I can respond.

Diagram • Discord • GitHub

Diagram Join Star

@better-auth-agent[bot] commented on GitHub (Dec 4, 2025): (tag @better-auth-agent if you would like an answer from the Agent) _If you need more help, tag @better-auth-agent in a comment so I can respond._ <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) • [Discord](https://discord.gg/fG2XXEuQX3) • [GitHub](https://github.com/Skyvern-AI/Skyvern) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/fG2XXEuQX3) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/Skyvern-AI/Skyvern)
GiteaMirror commented 2026-03-13 09:56:07 -05:00
Author
Owner
Copy Link

@ping-maxwell commented on GitHub (Dec 5, 2025):

You should be able to do this already using hooks

@ping-maxwell commented on GitHub (Dec 5, 2025): You should be able to do this already using hooks
GiteaMirror commented 2026-03-13 09:56:08 -05:00
Author
Owner
Copy Link

@mok419 commented on GitHub (Dec 5, 2025):

That would be amazing, haven't had a chance to begin testing yet!

I opened this before i found any docs on hooks (really difficult to navigate doc pages on mobile)!

But looking through the rate limiter code, it seemed decoupled from the lifecycle of requests hooks offer. I would be doing double db calls?

I will share more after sufficient testing! Appreciate the response though!

@mok419 commented on GitHub (Dec 5, 2025): That would be amazing, haven't had a chance to begin testing yet! I opened this before i found any docs on hooks (really difficult to navigate doc pages on mobile)! But looking through the rate limiter code, it seemed decoupled from the lifecycle of requests hooks offer. I would be doing double db calls? I will share more after sufficient testing! Appreciate the response though!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#2458
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?